Privacy Policy
Version 2026-09-09 · Effective 9 September 2026
This policy explains how Zavimi handles personal data across zavimi.com, the Zavimi application, and client-review links. It is written to cover Andorra’s Qualified Law 29/2021 on personal data protection (LQPD) and, when applicable, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
AI Crafters Solutions, SLU operates Zavimi and is the controller for account, billing, support, security, and marketing data.
Av. de les Nacions Unides 40AD700 Escaldes-Engordany
Principality of Andorra
privacy@andron.ai
A Zavimi account holder is normally the controller for the client contacts, files, feedback, and other content they submit. For that content, AI Crafters Solutions, SLU acts as a processor on the account holder’s instructions.
2. Data we collect and where it comes from
- Account data: email address, profile name, account identifiers, password hash, confirmation and session records, and the policy versions acknowledged at signup.
- Workspace and client-review data: client names and email addresses, project and delivery details, uploaded files and derived previews, comments, approval decisions, and review-link/session records.
- Billing data: Creem customer and subscription identifiers, product, subscription status, and billing-period dates. Zavimi does not receive or store full payment-card numbers.
- Messages and support: transactional email addresses and delivery status, plus feedback category, message, contact email, and the page from which feedback was sent.
- Technical and security data: IP address, user agent, device and browser details, request time, requested page, diagnostic information, and security events in provider and application logs.
- Optional website measurement: pages viewed, referrer, approximate country, browser, operating system, device type, session duration, engagement events, and advertising identifiers when optional tracking is allowed.
We receive data from you and your device, from the account holder who invites a client or sends a delivery, and from the service providers listed below. Please do not upload special-category or highly sensitive personal data unless it is necessary and you have a lawful basis to do so.
3. Why we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts, authenticate users, provide projects, files, deliveries, feedback, approval, and subscriptions | Contract or steps requested before a contract |
| Deliver review links and record client feedback on an account holder’s instructions | Account holder’s instructions; contract with the account holder |
| Operate, secure, troubleshoot, prevent abuse, and improve reliability | Our legitimate interests in a safe and reliable service |
| Process payments, keep accounting records, and respond to lawful requests | Contract and legal obligations |
| Answer support requests and product feedback | Contract and our legitimate interests in supporting and improving Zavimi |
| Run optional analytics or advertising measurement on the public website | Your consent, which you can refuse or withdraw |
The required signup checkbox records that you received and accepted these policy documents. It does not consent to optional analytics or advertising, and rejecting optional tracking does not prevent account creation or use of Zavimi.
4. Who receives data
We use providers only for the functions described here:
- DigitalOcean — application and worker hosting.
- Supabase — database, authentication, realtime updates, and job queues.
- Cloudflare R2 — private file storage in an EU-jurisdiction bucket.
- Resend — confirmation, recovery, review, and outcome email delivery.
- Creem — hosted checkout, payment processing, billing portal, and subscription events.
- Netlify — public website hosting.
- Umami Cloud — optional, cookieless website analytics.
- Reddit — optional advertising measurement.
A review recipient receives the delivery and content selected for that exact review link. Other disclosures may occur when you direct us, during a corporate transaction, or when law requires it. We do not sell personal data.
5. International transfers
Andorra is recognised by the European Commission as providing adequate data protection. Some providers may process data in the European Economic Area, the United States, or other countries. Where an adequacy decision does not cover a transfer, we rely on contractual safeguards such as the European Commission’s Standard Contractual Clauses and supplementary measures where appropriate. Contact us to request more information about the safeguards relevant to your data.
6. How long we keep data
- Account and workspace data is kept while the account is active.
- After a verified account-closure request, personal data is normally deleted or anonymised within 30 days, except where law, fraud prevention, payment records, unresolved disputes, or legal claims require longer retention. Limited backup copies may remain until the backup cycle completes.
- Client review links normally expire 30 days after sending; browser review sessions cannot outlive their link.
- The pending email-confirmation browser value expires after one hour.
- Subscription and transaction records are kept for the period required by accounting, tax, and claims laws.
- Security, diagnostic, email-delivery, support, and analytics records are retained only for the period needed for their purpose and then deleted or anonymised.
See the Cookie Policy for browser-storage durations.
7. Security
We use measures including encryption in transit, private object storage, short-lived signed file URLs, row-level database access controls, least-privilege service roles, hashed or encrypted review credentials, and restricted production secrets. No online service can guarantee absolute security.
8. Your choices and rights
Depending on the law that applies to you, you may request access, correction, deletion, restriction, portability, or object to processing. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also complain to the Andorran Data Protection Agency (APDA) or, where applicable, your local EU supervisory authority.
Email privacy@andron.ai. We may ask for information needed to verify identity and protect other people’s data. We do not use personal data for solely automated decisions that produce legal or similarly significant effects.
9. Children
Zavimi is a professional service and is not intended for anyone under 18.
10. Changes
We may update this policy as Zavimi, its providers, or applicable law changes. We will change the version and effective date here and give account holders appropriate notice of material changes. Where a new acknowledgement or consent is legally required, we will ask for it separately.